Riskcovery

CVE-2021-37865

Server-side Denial of Service while processing a specifically crafted GIF file

State
Published
Severity
4.3 Medium
Published
Jan 18, 2022
Updated
Dec 6, 2024
Reserved
Aug 2, 2021

Read the record on cve.org

Description

Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LMattermost

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
MattermostMattermost
  • 6.2 and earlierAffected
  • 6.1.1 to before unspecifiedNot affected
  • 6.0.4 to before unspecifiedNot affected
  • 5.39.3 to before unspecifiedNot affected
  • 5.37.6 to before unspecifiedNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.